Deprecate and Remove: Related Website Sets (RWS)

at a glance

background

Related Website Sets (RWS), formerly First Party Sets, let site operators declare formal relationships between domains they control (e.g. example.com, example.co.uk, static.example.com). Chrome used these declarations to grant limited cross-site cookie access via the Storage Access API (SAA) and document.requestStorageAccessFor().

RWS was designed as a transitional mechanism for a web without third-party cookies. Following Google's Privacy Sandbox next steps announcement that Chrome will maintain third-party cookies, RWS is no longer needed for its intended use case and is being removed.

Syntax and deprecated surfaces

// 1. Deprecated RWS declaration schema (canonical GitHub submission)
{
  "primary": "https://primary.example",
  "associatedSites": ["https://associated.example"],
  "serviceSites": ["https://service.example"]
}

// 2. Deprecated Chrome extension API
chrome.privacy.relatedWebsiteSetsEnabled.get({}, (details) => {
  /* returns boolean value; deprecated */
});

// 3. Deprecated Chrome Enterprise Policies
// RelatedWebsiteSetsEnabled (boolean)
// RelatedWebsiteSetsOverrides (JSON string defining enterprise sets)

The deprecation impacts three distinct platform components: the public canonical set declarations registered in the GoogleChrome/related-website-sets repository, the extension privacy setting chrome.privacy.relatedWebsiteSetsEnabled, and enterprise group policies governing set membership overrides.

what is removed

The Storage Access API itself continues to work; only the RWS-specific exemption path is removed. Without RWS, SAA requests from cross-site embeds go through the standard browser permission prompt flow.

Inputs and outputs

Inputs: The RWS framework accepted static JSON definitions listing primary, associated, and service site domains submitted via pull request to the central repository. The extension API accepted standard Chrome setting query objects. Enterprise policies accepted boolean flags and JSON-formatted override strings.

Outputs: Previously, RWS membership modified the behavior of document.requestStorageAccess() such that calls from intra-set domains were automatically resolved without displaying a permission prompt to the user. With removal, no automatic permission grants are issued, and calls return the same prompt-gated promise states as standard cross-site storage requests.

Errors and lifecycle

Errors: When RWS automatic grants are removed, calls to document.requestStorageAccess() that rely on silent set-based grants will now invoke the user prompt flow. If the user dismisses or denies the prompt, the promise rejects with a NotAllowedError DOMException, which callers must handle. In addition, calling removed APIs like document.requestStorageAccessFor() throws a TypeError or rejects as undefined on unsupported versions, and the deprecated chrome.privacy.relatedWebsiteSetsEnabled extension API is slated for removal alongside it - the intent names the setting and commits to following the relevant deprecation processes, without specifying per-call outcomes.

Lifecycle: Chrome 153 marks the start of the stepped rollout for RWS deprecation. The removal occurs gradually across Chrome releases, during which enterprise policies remain available to manage transitions before complete decommission.

Examples

The example below illustrates migrating cross-site cookie access from an RWS-reliant pattern to the standard, prompt-tolerant Storage Access API pattern:

// MIGRATION: Handle standard Storage Access API flow without RWS auto-grant.
// Note: RWS automatic grants are deprecated and removed starting in Chrome 153.
async function accessCrossSiteCookies() {
  // Check if access is already granted
  const hasAccess = await document.hasStorageAccess();
  if (hasAccess) {
    return true;
  }

  // Request storage access; this will now prompt the user rather than
  // auto-granting based on Related Website Sets membership.
  try {
    await document.requestStorageAccess();
    return true; // Access granted by user
  } catch (err) {
    if (err.name === 'NotAllowedError') {
      console.warn('Storage access prompt denied or dismissed by user');
    } else {
      console.error('Storage access request failed:', err);
    }
    return false;
  }
}

Extension background scripts can inspect the deprecated chrome.privacy.relatedWebsiteSetsEnabled setting during the deprecation phase to verify whether Related Website Sets behavior is enabled:

// Extension service worker: inspect deprecated chrome.privacy.relatedWebsiteSetsEnabled
chrome.privacy.relatedWebsiteSetsEnabled.get({}, (details) => {
  if (chrome.runtime.lastError) {
    console.warn('Failed to query relatedWebsiteSetsEnabled:', chrome.runtime.lastError.message);
    return;
  }
  console.log('RWS extension setting enabled:', details.value);
  console.log('Setting control level:', details.levelOfControl);
});

migration

Sites that used RWS to enable cross-site storage access should evaluate whether they still need cross-site access. If they do, the standard Storage Access API (without RWS) continues to work but requires explicit user permission. See the Storage Access API documentation for the standard flow.

browser compatibility

Related Website Sets was an engine-specific feature supported only in Chromium browsers. Firefox and Safari never implemented RWS or First-Party Sets, maintaining that cross-site boundaries must not be automatically relaxed without user agency.

security and privacy

• Privacy enhancement: Deprecating and removing RWS eliminates automated cross-site cookie sharing channels, restoring standard first-party boundary isolation across all domains.
• Explicit consent: Storage access across site boundaries now uniformly requires explicit user consent through the Storage Access API prompt flow across all browser engines.
• Reduced abuse surface: Removing declared set lists prevents malicious or mistaken multi-domain groupings from bypassing third-party storage restrictions.

see also

• Chrome Platform Status — Deprecate and Remove: Related Website Sets (RWS)
• gendn — v153: Deprecate and Remove: document.requestStorageAccessFor
• Privacy Sandbox — next steps announcement
• Privacy Sandbox — Related Website Sets documentation